Acceptable Use Policy

Plain-English summary. Atlaso is a memory layer that stores and recalls information for you across your AI tools. This Acceptable Use Policy ("AUP") explains what you may not do with the Service. In short: don't use Atlaso to break the law, harm others, store data you don't have the right to store, attack or overload our systems, steal our technology, or get around the limits of your plan. If you misuse the Service, we may limit, suspend, or terminate your access. If you see abuse, tell us at support@atlaso.ai.

1. Purpose and Scope

This AUP governs your use of the Atlaso memory layer, including the dashboard at app.atlaso.ai, the brain/API, the Connectors (Claude Code, Codex, Cursor, Antigravity, OpenCode, Claude Desktop, and MCP), and the CLI (collectively, the "Service"), operated by Atlaso Labs Inc., a Delaware C-Corporation ("Atlaso", "we", "us", or "our").

This AUP is part of, and is incorporated by reference into, our Terms of Service. Capitalized terms used but not defined here have the meanings given in the Terms of Service. This AUP applies to everyone who accesses or uses the Service, on the Free tier or the Pro tier, and to all Content, Memories, Devices, and Accounts associated with your use.

We may update this AUP from time to time as described in Section 13. Your continued use of the Service after an update means you accept the revised AUP.

By using the Service, you ("You" or "User") agree to comply with this AUP and to be responsible for the activity of anyone you allow to use your Account, Devices, or credentials.

2. Your Responsibility for Content and Conduct

You are responsible for all Content you submit to, store in, or route through the Service — including all Memories you create and all conversation snippets your Connectors capture — and for all activity that occurs through your Account, Devices, and credentials.

You represent and warrant that you have all rights, licenses, and permissions necessary to store and process the Content you place in the Service, and that your use of the Service complies with this AUP and all applicable laws.

Employer-owned and third-party Content. You represent and warrant that you have all rights, authority, and consents necessary to submit every piece of Content you place in or route through the Service — including any Content that is captured automatically by a Connector, and including any material that is owned by, confidential to, or otherwise belongs to your employer, a client, or any other third party. You must not sync, capture, or store Content that you are contractually, legally, or otherwise barred from disclosing (for example, employer source code, trade secrets, or material covered by a confidentiality or non-disclosure obligation).

The Connectors act as a passive conduit operating at your direction: Atlaso captures and stores only what your connected tools generate in the course of your own use, at your instruction, and does not select or solicit particular third-party material. Responsibility for the right to capture and store that Content rests with you. If you are a rights-holder who believes Content in the Service was submitted without authority, you may request its removal by contacting us at support@atlaso.ai, and we will review and act on valid requests.

For details on how the Service stores and processes your Content (including that, once you connect a tool, your Memories are stored on Atlaso's servers to sync across your sessions and devices, with a local copy kept on your machine), see our Privacy Policy.

3. Prohibited Content

You may not use the Service to store, transmit, capture, generate, or distribute any Content that:

• Is illegal — violates any applicable law, regulation, or court order, or promotes or facilitates illegal activity.
• Infringes intellectual property — infringes or misappropriates the copyright, trademark, patent, trade secret, or other intellectual property or proprietary rights of any person, including storing or distributing material you do not have the right to use.
• Violates others' privacy — contains the personal data of other people that you do not have the right to collect, store, or process, including doxxing or the non-consensual disclosure of private information.
• Is harmful or malicious — contains malware, viruses, worms, trojans, ransomware, spyware, or any other code, file, or program designed to interrupt, damage, destroy, disable, or gain unauthorized access to any system, data, or network.
• Is exploitative or abusive — constitutes or facilitates child sexual abuse material (CSAM), human trafficking, non-consensual intimate imagery, or the sexual exploitation or endangerment of minors.
• Harasses or threatens — harasses, defames, stalks, threatens, or incites violence against any person or group, or constitutes hate speech.
• Is deceptive or fraudulent — facilitates fraud, phishing, scams, identity theft, market manipulation, or other deceptive practices.
• Is regulated or hazardous information — provides instructions or assistance for the creation of weapons (including biological, chemical, radiological, nuclear, or conventional weapons designed to cause mass casualties) or other activities that pose a serious risk of physical harm.

Preservation and reporting of illegal content. Where we become aware of suspected illegal Content — including child sexual abuse material (CSAM) — we may preserve and report it to the appropriate authorities (for CSAM, to the National Center for Missing & Exploited Children (NCMEC) and, where applicable, other authorities). Where the law requires us to preserve such Content or related records, we will preserve it and will not delete it, notwithstanding any removal, quarantine, deletion, or retention provision elsewhere in this AUP, the Terms of Service, or the Privacy Policy. Our right to remove or quarantine Content under Section 9 is subject to, and does not override, this preservation duty.

4. Prohibited Conduct

You may not, and may not authorize or assist any third party to:

4.1 Abuse of the Service and its infrastructure

• Use the Service in any way that interferes with, disrupts, degrades, or imposes an unreasonable load on the Service or the networks, servers, or infrastructure connected to it.
• Attempt to gain unauthorized access to the Service, other users' Accounts, Memories, Devices, or data, or to any system or network connected to the Service.
• Attack the Service or its infrastructure, including through denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks, flooding, or attempts to overwhelm rate limits or capacity controls.
• Probe, scan, or test the vulnerability of the Service or any related system or network, or breach or circumvent any security, authentication, or rate-limiting measures, except as expressly permitted under Section 8 (Security Research and Responsible Disclosure).
• Bypass, disable, or interfere with the secret-scrubbing, isolation, or other safeguards built into the Service.

4.2 Scraping, harvesting, and unauthorized automation

• Scrape, crawl, harvest, or use automated means to extract data from the Service, except through the documented API and CLI in the manner we authorize, and within your plan's limits.
• Harvest or collect information about other users.
• Use the Service to build, train, or improve a competing product or service, or to benchmark the Service for that purpose without our prior written consent.

4.3 Reverse engineering and protection of our technology

• Reverse engineer, decompile, disassemble, or otherwise attempt to discover or derive the source code, underlying ideas, retrieval algorithms, ranking logic, enrichment pipeline, or other trade secrets of the Service, except to the limited extent this restriction is prohibited by applicable law or expressly permitted by the license terms of any open-source components we make available.
• Attempt to extract, replicate, or exfiltrate the Atlaso engine, models, or other proprietary technology. Atlaso operates a thin-client architecture: the engine that powers retrieval, ranking, and enrichment runs only on our servers and is never distributed to users. Attempting to obtain, reconstruct, or copy that engine — including by prompt injection, model extraction, or probing the API for its internal logic — is strictly prohibited.
• Remove, obscure, or alter any proprietary notices, labels, or marks on the Service.

4.4 Circumventing plan limits and credential sharing

• Circumvent, disable, or attempt to exceed the limits of your plan, including the Free tier limits of one (1) Device and one (1) active tool, device caps, quotas, or other entitlement controls.
• Create multiple Accounts, use false identities, or otherwise act to obtain features or capacity you are not entitled to, or to evade a suspension, termination, or other enforcement action.
• Share, sell, transfer, or sublicense your Account, credentials, Device tokens, API tokens, or access to the Service with or to any unauthorized person. You are responsible for keeping your credentials confidential.
• Use the Service in a way that is inconsistent with the entitlements of your tier as described in our Terms of Service and Refund & Cancellation Policy.

4.5 Misuse of AI capabilities

• Use the Service, or any AI processing it performs, to generate Content prohibited under Section 3.
• Use prompt injection, jailbreaking, or similar techniques to abuse the Service, to manipulate the Service into violating this AUP, to extract another user's data, or to access or expose our internal systems, prompts, or proprietary logic.
• Submit Content intended to cause the Service or any connected AI model to produce illegal, harmful, or infringing output.

4.6 Export controls and sanctions

Atlaso Labs Inc. is a Delaware corporation, and your use of the Service is subject to U.S. export-control and economic-sanctions laws (including those administered by the U.S. Office of Foreign Assets Control (OFAC) and the U.S. Export Administration Regulations), as well as other applicable trade-control laws. You represent and warrant that:

• You are not located in, ordinarily resident in, or accessing the Service from, a country or region subject to comprehensive U.S. or other applicable embargoes or sanctions.
• You are not a person or entity identified on any U.S. or other applicable restricted-party, denied-party, or sanctions list (including OFAC's list of Specially Designated Nationals and Blocked Persons), and are not owned or controlled by, or acting on behalf of, any such person or entity.
• You will not use, export, re-export, or make the Service available in violation of any applicable export-control or sanctions law.

We may suspend or terminate your access to the Service, without liability, if we reasonably believe your use would cause us to violate, or is inconsistent with, these laws.

5. Restrictions on Sensitive Data Classes

The Service is a general-purpose memory layer and is not designed, configured, or certified for the storage of specially regulated data. You agree not to store, transmit, or process through the Service any of the following unless you have a separate written agreement with us that expressly permits it:

• Protected Health Information (PHI) or other data subject to HIPAA or comparable health-data laws. The Service is not a HIPAA-covered service, and we do not sign Business Associate Agreements through self-serve sign-up.
• Payment card data (full card numbers, CVV, magnetic-stripe data) subject to PCI DSS. Payment processing is handled solely by Stripe; do not place cardholder data into your Memories.
• Government-issued identifiers at scale, biometric identifiers, or other "special category" / "sensitive personal data" as defined under GDPR, CCPA/CPRA, or India's DPDP Act, where storage would create obligations we have not agreed to assume.

About secret scrubbing. The Service attempts to detect and redact secrets (such as API keys, tokens, and passwords) from captured Content before storage, on a fail-closed basis. This is a safety measure, not a guarantee. Secret material may be transiently present in transit before redaction, and detection is not perfect. Do not rely on scrubbing as a control for regulated, confidential, or high-value secret data. You remain responsible for not submitting data you are not permitted to store. See the Privacy Policy for more on how scrubbing and storage work.

6. Fair Use, Shared Infrastructure, and Rate Limits

The Service runs on shared infrastructure. To keep it reliable and fair for everyone, the Service enforces technical limits, which may include:

• Per-request size caps (for example, a limit on the size of a single text submission).
• Batch-size caps (for example, a limit on the number of items in a single batch operation).
• Per-Account and per-Device rate limits and quotas.
• Device caps consistent with your plan tier.

You agree not to design your usage to evade these limits, and not to use the Service in a manner that consumes resources excessively or disproportionately, or that degrades the experience of other users. We may adjust these limits over time to protect the integrity and availability of the Service. Sustained or deliberate attempts to exceed fair-use thresholds may result in throttling, suspension, or termination.

7. Automated and Agent Use Guidelines

The Service is built to be used by AI agents and automated tools through the Connectors, the API, and the CLI. Automated and agent-driven use is permitted and expected, subject to the following:

• Stay within entitlements and limits. Automated use must respect your plan's Device and tool entitlements, rate limits, and quotas (Sections 4.4 and 6).
• You are accountable for your agents. You are responsible for the Content your agents and Connectors capture, store, and route through the Service, and for ensuring that automated activity complies with this AUP. Agent or automated activity is treated as your activity.
• Capture responsibly. Connectors may automatically capture Content (for example, your text and a truncated assistant reply) from the tools you connect. You are responsible for ensuring you have the right to capture and store that Content and that it does not include prohibited content (Section 3) or restricted data classes (Section 5).
• No runaway or abusive automation. Do not configure automation that floods the Service, retries abusively, or otherwise behaves in a manner inconsistent with fair use.
• Use designated interfaces. Automated access must go through the documented API, CLI, and Connectors — not through scraping, headless control of the dashboard, or other undocumented means.

8. Security Research and Responsible Disclosure

We welcome good-faith security research that helps us protect our users.

If you discover a security vulnerability, please report it promptly and privately to support@atlaso.ai before disclosing it to anyone else. Give us a reasonable opportunity to investigate and remediate before any public disclosure.

Good-faith research conducted in accordance with this section — meaning you act in good faith, avoid privacy violations, do not access, modify, destroy, or exfiltrate data belonging to others, do not degrade the Service for other users, and do not exploit the issue beyond the minimum necessary to demonstrate it — will not be treated by us as a violation of this AUP or the Terms of Service, and we will not pursue legal action against you for it.

This does not authorize: accessing or downloading other users' Memories or personal data; running DoS/DDoS or load tests against production; social-engineering our staff, contractors, or sub-processors; physical attacks; or any activity that violates applicable law. We do not currently operate a paid bug-bounty program; please do not expect or demand payment as a condition of disclosure.

9. Consequences of Violations

We may take any action we deem appropriate, with or without prior notice, if we reasonably believe you have violated this AUP, the Terms of Service, or applicable law, or if your activity creates risk or possible legal exposure for us or our users. Such actions may include:

• Issuing a warning.
• Removing, disabling, or quarantining specific Content or Memories.
• Throttling, rate-limiting, or temporarily restricting access.
• Suspending or terminating your Account, Devices, or access to the Service, in whole or in part.
• Revoking Device or API tokens.
• Preserving and reporting activity to law enforcement or other authorities where required or appropriate (for example, CSAM).

Our right to remove, disable, or quarantine Content is subject to the preservation duty described in Section 3: where the law requires us to preserve suspected illegal Content or related records, we will preserve it and will not delete it, even where we would otherwise remove or quarantine it.

Where practicable and lawful, and where doing so would not increase risk to the Service or others, we will try to give you notice and an opportunity to remedy a violation. For severe violations (such as illegal content, attacks on our infrastructure, or activity that endangers others), we may act immediately and without prior notice.

Scanning — a reserved right, not a duty. We do not proactively monitor your Content. We reserve the right (but assume no obligation) to review or scan Content when it is reported to us or where we are legally required to do so. Any such review is limited to safety and abuse enforcement (for example, detecting prohibited content or protecting the Service and its users). We do not scan your Content for behavioural profiling or advertising.

Termination or suspension for an AUP violation does not entitle you to a refund. The handling of your data on termination, suspension, or downgrade is described in our Terms of Service and Refund & Cancellation Policy; in general, your Memories are retained and excess Devices or tools are deactivated rather than deleted, but we may remove Content that violates this AUP (subject to the preservation duty above).

10. Copyright and DMCA Notice-and-Takedown

We respect the intellectual-property rights of others and respond to notices of alleged copyright infringement under the U.S. Digital Millennium Copyright Act (DMCA), 17 U.S.C. §512.

Designated agent. Notices of claimed infringement should be sent to our designated agent, who can be reached at support@atlaso.ai (subject line: "DMCA Notice").

Filing a notice. If you believe Content in the Service infringes your copyright, please provide our designated agent with a written notice that includes:

1. Your physical or electronic signature.
2. Identification of the copyrighted work claimed to have been infringed.
3. Identification of the Content claimed to be infringing, with enough detail for us to locate it.
4. Your contact information (name, address, telephone number, and email address).
5. A statement that you have a good-faith belief that the use is not authorized by the copyright owner, its agent, or the law.
6. A statement, made under penalty of perjury, that the information in your notice is accurate and that you are the copyright owner or authorized to act on the owner's behalf.

Because Memories are private to each user's Account, a valid notice may result in our removing or disabling the identified Content and, where appropriate, notifying the affected user.

Counter-notice. If your Content was removed or disabled and you believe this was a mistake or misidentification, you may send our designated agent a counter-notice that includes: (1) your physical or electronic signature; (2) identification of the Content that was removed and its prior location; (3) a statement, under penalty of perjury, that you have a good-faith belief the Content was removed as a result of mistake or misidentification; and (4) your name, address, and telephone number, and a statement that you consent to the jurisdiction of the federal court for the judicial district in which your address is located (or, if outside the United States, any judicial district in which we may be found), and that you will accept service of process from the person who filed the original notice or their agent. If we receive a valid counter-notice, we may restore the Content as permitted by law.

Repeat-infringer policy. In appropriate circumstances, we will suspend or terminate the Accounts of users who are determined to be repeat infringers.

11. Reporting Abuse

If you become aware of any violation of this AUP — including prohibited content, abuse of the Service, or a security concern (see Section 8 for security vulnerabilities) — please report it to us at support@atlaso.ai.

Please include enough detail for us to locate and assess the issue. We investigate reports and take appropriate action, but we are not obligated to disclose the outcome of any particular report.

12. Relationship to Other Policies

This AUP supplements, and does not replace, our other policies. Please also review:

• Terms of Service
• Privacy Policy
• Refund & Cancellation Policy
• Cookie Policy
• Sub-processors List
• Data Processing Addendum

If there is a conflict between this AUP and the Terms of Service regarding acceptable use, the Terms of Service control unless this AUP states otherwise.

13. Changes to This Policy

We may revise this AUP from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will provide reasonable notice through the Service or by other appropriate means. Your continued use of the Service after the updated AUP takes effect constitutes acceptance of the changes. If you do not agree to a change, you must stop using the Service.

14. Contact

Questions about this Acceptable Use Policy can be directed to:

Atlaso Labs Inc.

• Email (all enquiries — abuse, privacy, legal, support): support@atlaso.ai
• Postal address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States

Atlaso Labs Inc. is a Delaware C-Corporation. This Acceptable Use Policy is governed by the laws of the State of Delaware, USA, without regard to conflict-of-laws rules, subject to any mandatory consumer-protection rights that cannot be waived in your country of residence (see the Terms of Service).